[BUG] openssl.cnf gets overwritten

[sozercan]

Version of copa

0.8.0

Expected Behavior

openssl.cnf is not overwritten during patch. This does not happen with Mariner core image (mcr.microsoft.com/cbl-mariner/base/core)

Actual Behavior

openssl.cnf is overwritten which may break certain configurations

Steps To Reproduce

• Create openssl.cnf file with any data

• Create a Dockerfile with the following contents:

FROM mcr.microsoft.com/cbl-mariner/distroless/base:2.0.20240112
COPY openssl.cnf /etc/pki/tls/

Please note that base image is specifically selected to pin to a version that has an openssl vulnerability

• Build image with docker build -t openssl:test .
• Notice custom openssl.cnf is in /etc/pki/tls/ path. example: https://oci.dag.dev/layers/sozercan/openssl@sha256:4f15e75c292a2fcb04e55ee4b93cb3449424b9360831490339d3132b1a31a735/etc/pki/tls/
• Copa patch the image using copa patch -i openssl:test
• Notice patched image containing openssl.cnf is overwritten by copa: https://oci.dag.dev/layers/sozercan/openssl:test-patched@sha256:1d703d7013826dadde6c1ed3f32ce8b4b1431b8f1bbeedf7bc92863e2f20fda8/etc/pki/tls/

Are you willing to submit PRs to contribute to this bug fix?

• Yes, I am willing to implement it.